pulumi-kafka 3.8.0a1723819820__py3-none-any.whl → 3.13.0a1763619276__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
pulumi_kafka/acl.py CHANGED
@@ -1,12 +1,17 @@
1
1
  # coding=utf-8
2
- # *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
2
+ # *** WARNING: this file was generated by pulumi-language-python. ***
3
3
  # *** Do not edit by hand unless you're certain you know what you are doing! ***
4
4
 
5
- import copy
5
+ import builtins as _builtins
6
6
  import warnings
7
+ import sys
7
8
  import pulumi
8
9
  import pulumi.runtime
9
10
  from typing import Any, Mapping, Optional, Sequence, Union, overload
11
+ if sys.version_info >= (3, 11):
12
+ from typing import NotRequired, TypedDict, TypeAlias
13
+ else:
14
+ from typing_extensions import NotRequired, TypedDict, TypeAlias
10
15
  from . import _utilities
11
16
 
12
17
  __all__ = ['AclArgs', 'Acl']
@@ -14,28 +19,16 @@ __all__ = ['AclArgs', 'Acl']
14
19
  @pulumi.input_type
15
20
  class AclArgs:
16
21
  def __init__(__self__, *,
17
- acl_host: pulumi.Input[str],
18
- acl_operation: pulumi.Input[str],
19
- acl_permission_type: pulumi.Input[str],
20
- acl_principal: pulumi.Input[str],
21
- acl_resource_name: pulumi.Input[str],
22
- acl_resource_type: pulumi.Input[str],
23
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None):
22
+ acl_host: pulumi.Input[_builtins.str],
23
+ acl_operation: pulumi.Input[_builtins.str],
24
+ acl_permission_type: pulumi.Input[_builtins.str],
25
+ acl_principal: pulumi.Input[_builtins.str],
26
+ acl_resource_name: pulumi.Input[_builtins.str],
27
+ acl_resource_type: pulumi.Input[_builtins.str],
28
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
24
29
  """
25
30
  The set of arguments for constructing a Acl resource.
26
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
27
- will have access.
28
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
29
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
30
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
31
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
32
- `Any`, `Allow`, `Deny`.
33
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
34
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
35
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
36
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
37
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
38
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
31
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
39
32
  """
40
33
  pulumi.set(__self__, "acl_host", acl_host)
41
34
  pulumi.set(__self__, "acl_operation", acl_operation)
@@ -46,122 +39,86 @@ class AclArgs:
46
39
  if resource_pattern_type_filter is not None:
47
40
  pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
48
41
 
49
- @property
42
+ @_builtins.property
50
43
  @pulumi.getter(name="aclHost")
51
- def acl_host(self) -> pulumi.Input[str]:
52
- """
53
- Host from which principal listed in `acl_principal`
54
- will have access.
55
- """
44
+ def acl_host(self) -> pulumi.Input[_builtins.str]:
56
45
  return pulumi.get(self, "acl_host")
57
46
 
58
47
  @acl_host.setter
59
- def acl_host(self, value: pulumi.Input[str]):
48
+ def acl_host(self, value: pulumi.Input[_builtins.str]):
60
49
  pulumi.set(self, "acl_host", value)
61
50
 
62
- @property
51
+ @_builtins.property
63
52
  @pulumi.getter(name="aclOperation")
64
- def acl_operation(self) -> pulumi.Input[str]:
65
- """
66
- Operation that is being allowed or denied. Valid
67
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
68
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
69
- """
53
+ def acl_operation(self) -> pulumi.Input[_builtins.str]:
70
54
  return pulumi.get(self, "acl_operation")
71
55
 
72
56
  @acl_operation.setter
73
- def acl_operation(self, value: pulumi.Input[str]):
57
+ def acl_operation(self, value: pulumi.Input[_builtins.str]):
74
58
  pulumi.set(self, "acl_operation", value)
75
59
 
76
- @property
60
+ @_builtins.property
77
61
  @pulumi.getter(name="aclPermissionType")
78
- def acl_permission_type(self) -> pulumi.Input[str]:
79
- """
80
- Type of permission. Valid values are `Unknown`,
81
- `Any`, `Allow`, `Deny`.
82
- """
62
+ def acl_permission_type(self) -> pulumi.Input[_builtins.str]:
83
63
  return pulumi.get(self, "acl_permission_type")
84
64
 
85
65
  @acl_permission_type.setter
86
- def acl_permission_type(self, value: pulumi.Input[str]):
66
+ def acl_permission_type(self, value: pulumi.Input[_builtins.str]):
87
67
  pulumi.set(self, "acl_permission_type", value)
88
68
 
89
- @property
69
+ @_builtins.property
90
70
  @pulumi.getter(name="aclPrincipal")
91
- def acl_principal(self) -> pulumi.Input[str]:
92
- """
93
- Principal that is being allowed or denied.
94
- """
71
+ def acl_principal(self) -> pulumi.Input[_builtins.str]:
95
72
  return pulumi.get(self, "acl_principal")
96
73
 
97
74
  @acl_principal.setter
98
- def acl_principal(self, value: pulumi.Input[str]):
75
+ def acl_principal(self, value: pulumi.Input[_builtins.str]):
99
76
  pulumi.set(self, "acl_principal", value)
100
77
 
101
- @property
78
+ @_builtins.property
102
79
  @pulumi.getter(name="aclResourceName")
103
- def acl_resource_name(self) -> pulumi.Input[str]:
80
+ def acl_resource_name(self) -> pulumi.Input[_builtins.str]:
104
81
  """
105
- The name of the resource.
82
+ The name of the resource
106
83
  """
107
84
  return pulumi.get(self, "acl_resource_name")
108
85
 
109
86
  @acl_resource_name.setter
110
- def acl_resource_name(self, value: pulumi.Input[str]):
87
+ def acl_resource_name(self, value: pulumi.Input[_builtins.str]):
111
88
  pulumi.set(self, "acl_resource_name", value)
112
89
 
113
- @property
90
+ @_builtins.property
114
91
  @pulumi.getter(name="aclResourceType")
115
- def acl_resource_type(self) -> pulumi.Input[str]:
116
- """
117
- The type of resource. Valid values are `Unknown`,
118
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
119
- """
92
+ def acl_resource_type(self) -> pulumi.Input[_builtins.str]:
120
93
  return pulumi.get(self, "acl_resource_type")
121
94
 
122
95
  @acl_resource_type.setter
123
- def acl_resource_type(self, value: pulumi.Input[str]):
96
+ def acl_resource_type(self, value: pulumi.Input[_builtins.str]):
124
97
  pulumi.set(self, "acl_resource_type", value)
125
98
 
126
- @property
99
+ @_builtins.property
127
100
  @pulumi.getter(name="resourcePatternTypeFilter")
128
- def resource_pattern_type_filter(self) -> Optional[pulumi.Input[str]]:
129
- """
130
- The pattern filter. Valid values
131
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
132
- """
101
+ def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
133
102
  return pulumi.get(self, "resource_pattern_type_filter")
134
103
 
135
104
  @resource_pattern_type_filter.setter
136
- def resource_pattern_type_filter(self, value: Optional[pulumi.Input[str]]):
105
+ def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
137
106
  pulumi.set(self, "resource_pattern_type_filter", value)
138
107
 
139
108
 
140
109
  @pulumi.input_type
141
110
  class _AclState:
142
111
  def __init__(__self__, *,
143
- acl_host: Optional[pulumi.Input[str]] = None,
144
- acl_operation: Optional[pulumi.Input[str]] = None,
145
- acl_permission_type: Optional[pulumi.Input[str]] = None,
146
- acl_principal: Optional[pulumi.Input[str]] = None,
147
- acl_resource_name: Optional[pulumi.Input[str]] = None,
148
- acl_resource_type: Optional[pulumi.Input[str]] = None,
149
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None):
112
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
113
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
114
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
115
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
116
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
117
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
118
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
150
119
  """
151
120
  Input properties used for looking up and filtering Acl resources.
152
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
153
- will have access.
154
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
155
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
156
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
157
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
158
- `Any`, `Allow`, `Deny`.
159
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
160
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
161
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
162
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
163
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
164
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
121
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
165
122
  """
166
123
  if acl_host is not None:
167
124
  pulumi.set(__self__, "acl_host", acl_host)
@@ -178,156 +135,206 @@ class _AclState:
178
135
  if resource_pattern_type_filter is not None:
179
136
  pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
180
137
 
181
- @property
138
+ @_builtins.property
182
139
  @pulumi.getter(name="aclHost")
183
- def acl_host(self) -> Optional[pulumi.Input[str]]:
184
- """
185
- Host from which principal listed in `acl_principal`
186
- will have access.
187
- """
140
+ def acl_host(self) -> Optional[pulumi.Input[_builtins.str]]:
188
141
  return pulumi.get(self, "acl_host")
189
142
 
190
143
  @acl_host.setter
191
- def acl_host(self, value: Optional[pulumi.Input[str]]):
144
+ def acl_host(self, value: Optional[pulumi.Input[_builtins.str]]):
192
145
  pulumi.set(self, "acl_host", value)
193
146
 
194
- @property
147
+ @_builtins.property
195
148
  @pulumi.getter(name="aclOperation")
196
- def acl_operation(self) -> Optional[pulumi.Input[str]]:
197
- """
198
- Operation that is being allowed or denied. Valid
199
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
200
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
201
- """
149
+ def acl_operation(self) -> Optional[pulumi.Input[_builtins.str]]:
202
150
  return pulumi.get(self, "acl_operation")
203
151
 
204
152
  @acl_operation.setter
205
- def acl_operation(self, value: Optional[pulumi.Input[str]]):
153
+ def acl_operation(self, value: Optional[pulumi.Input[_builtins.str]]):
206
154
  pulumi.set(self, "acl_operation", value)
207
155
 
208
- @property
156
+ @_builtins.property
209
157
  @pulumi.getter(name="aclPermissionType")
210
- def acl_permission_type(self) -> Optional[pulumi.Input[str]]:
211
- """
212
- Type of permission. Valid values are `Unknown`,
213
- `Any`, `Allow`, `Deny`.
214
- """
158
+ def acl_permission_type(self) -> Optional[pulumi.Input[_builtins.str]]:
215
159
  return pulumi.get(self, "acl_permission_type")
216
160
 
217
161
  @acl_permission_type.setter
218
- def acl_permission_type(self, value: Optional[pulumi.Input[str]]):
162
+ def acl_permission_type(self, value: Optional[pulumi.Input[_builtins.str]]):
219
163
  pulumi.set(self, "acl_permission_type", value)
220
164
 
221
- @property
165
+ @_builtins.property
222
166
  @pulumi.getter(name="aclPrincipal")
223
- def acl_principal(self) -> Optional[pulumi.Input[str]]:
224
- """
225
- Principal that is being allowed or denied.
226
- """
167
+ def acl_principal(self) -> Optional[pulumi.Input[_builtins.str]]:
227
168
  return pulumi.get(self, "acl_principal")
228
169
 
229
170
  @acl_principal.setter
230
- def acl_principal(self, value: Optional[pulumi.Input[str]]):
171
+ def acl_principal(self, value: Optional[pulumi.Input[_builtins.str]]):
231
172
  pulumi.set(self, "acl_principal", value)
232
173
 
233
- @property
174
+ @_builtins.property
234
175
  @pulumi.getter(name="aclResourceName")
235
- def acl_resource_name(self) -> Optional[pulumi.Input[str]]:
176
+ def acl_resource_name(self) -> Optional[pulumi.Input[_builtins.str]]:
236
177
  """
237
- The name of the resource.
178
+ The name of the resource
238
179
  """
239
180
  return pulumi.get(self, "acl_resource_name")
240
181
 
241
182
  @acl_resource_name.setter
242
- def acl_resource_name(self, value: Optional[pulumi.Input[str]]):
183
+ def acl_resource_name(self, value: Optional[pulumi.Input[_builtins.str]]):
243
184
  pulumi.set(self, "acl_resource_name", value)
244
185
 
245
- @property
186
+ @_builtins.property
246
187
  @pulumi.getter(name="aclResourceType")
247
- def acl_resource_type(self) -> Optional[pulumi.Input[str]]:
248
- """
249
- The type of resource. Valid values are `Unknown`,
250
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
251
- """
188
+ def acl_resource_type(self) -> Optional[pulumi.Input[_builtins.str]]:
252
189
  return pulumi.get(self, "acl_resource_type")
253
190
 
254
191
  @acl_resource_type.setter
255
- def acl_resource_type(self, value: Optional[pulumi.Input[str]]):
192
+ def acl_resource_type(self, value: Optional[pulumi.Input[_builtins.str]]):
256
193
  pulumi.set(self, "acl_resource_type", value)
257
194
 
258
- @property
195
+ @_builtins.property
259
196
  @pulumi.getter(name="resourcePatternTypeFilter")
260
- def resource_pattern_type_filter(self) -> Optional[pulumi.Input[str]]:
261
- """
262
- The pattern filter. Valid values
263
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
264
- """
197
+ def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
265
198
  return pulumi.get(self, "resource_pattern_type_filter")
266
199
 
267
200
  @resource_pattern_type_filter.setter
268
- def resource_pattern_type_filter(self, value: Optional[pulumi.Input[str]]):
201
+ def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
269
202
  pulumi.set(self, "resource_pattern_type_filter", value)
270
203
 
271
204
 
205
+ @pulumi.type_token("kafka:index/acl:Acl")
272
206
  class Acl(pulumi.CustomResource):
273
207
  @overload
274
208
  def __init__(__self__,
275
209
  resource_name: str,
276
210
  opts: Optional[pulumi.ResourceOptions] = None,
277
- acl_host: Optional[pulumi.Input[str]] = None,
278
- acl_operation: Optional[pulumi.Input[str]] = None,
279
- acl_permission_type: Optional[pulumi.Input[str]] = None,
280
- acl_principal: Optional[pulumi.Input[str]] = None,
281
- acl_resource_name: Optional[pulumi.Input[str]] = None,
282
- acl_resource_type: Optional[pulumi.Input[str]] = None,
283
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None,
211
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
212
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
213
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
214
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
215
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
216
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
217
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
284
218
  __props__=None):
285
219
  """
286
- A resource for managing Kafka ACLs.
220
+ The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
287
221
 
288
222
  ## Example Usage
289
223
 
224
+ ### Allow Producer Access to Topic
225
+
290
226
  ```python
291
227
  import pulumi
292
228
  import pulumi_kafka as kafka
293
229
 
294
- test = kafka.Acl("test",
295
- acl_resource_name="syslog",
230
+ producer = kafka.Acl("producer",
231
+ acl_resource_name="orders",
296
232
  acl_resource_type="Topic",
297
- acl_principal="User:Alice",
233
+ acl_principal="User:producer-service",
298
234
  acl_host="*",
299
235
  acl_operation="Write",
300
- acl_permission_type="Deny")
236
+ acl_permission_type="Allow")
237
+ # Also grant describe permission for producers
238
+ producer_describe = kafka.Acl("producer_describe",
239
+ acl_resource_name="orders",
240
+ acl_resource_type="Topic",
241
+ acl_principal="User:producer-service",
242
+ acl_host="*",
243
+ acl_operation="Describe",
244
+ acl_permission_type="Allow")
301
245
  ```
302
246
 
303
- ## Import
247
+ ### Allow Consumer Group Access
304
248
 
305
- ACLs can be imported using the following pattern
249
+ ```python
250
+ import pulumi
251
+ import pulumi_kafka as kafka
306
252
 
307
- ```sh
308
- $ pulumi import kafka:index/acl:Acl test "acl_principal|acl_host|acl_operation|acl_permission_type|resource_type|resource_name|resource_pattern_type_filter"
253
+ # Allow read access to topic
254
+ consumer_read = kafka.Acl("consumer_read",
255
+ acl_resource_name="orders",
256
+ acl_resource_type="Topic",
257
+ acl_principal="User:consumer-service",
258
+ acl_host="*",
259
+ acl_operation="Read",
260
+ acl_permission_type="Allow")
261
+ # Allow access to consumer group
262
+ consumer_group = kafka.Acl("consumer_group",
263
+ acl_resource_name="order-processors",
264
+ acl_resource_type="Group",
265
+ acl_principal="User:consumer-service",
266
+ acl_host="*",
267
+ acl_operation="Read",
268
+ acl_permission_type="Allow")
309
269
  ```
310
- e.g.
270
+
271
+ ### Prefix-Based Access Control
272
+
273
+ ```python
274
+ import pulumi
275
+ import pulumi_kafka as kafka
276
+
277
+ # Grant access to all topics with prefix "logs-"
278
+ logs_access = kafka.Acl("logs_access",
279
+ acl_resource_name="logs-",
280
+ acl_resource_type="Topic",
281
+ resource_pattern_type_filter="Prefixed",
282
+ acl_principal="User:log-aggregator",
283
+ acl_host="*",
284
+ acl_operation="Read",
285
+ acl_permission_type="Allow")
286
+ ```
287
+
288
+ ### Admin User with Full Access
289
+
290
+ ```python
291
+ import pulumi
292
+ import pulumi_kafka as kafka
293
+
294
+ # Grant cluster-level admin access
295
+ admin_cluster = kafka.Acl("admin_cluster",
296
+ acl_resource_name="kafka-cluster",
297
+ acl_resource_type="Cluster",
298
+ acl_principal="User:admin",
299
+ acl_host="*",
300
+ acl_operation="All",
301
+ acl_permission_type="Allow")
302
+ ```
303
+
304
+ ## Common ACL Patterns
305
+
306
+ ### Producer ACLs
307
+ Producers typically need:
308
+ - `Write` and `Describe` on topics
309
+ - `Write` on `TransactionalID` (for transactional producers)
310
+ - `IdempotentWrite` on `Cluster` (for idempotent producers)
311
+
312
+ ### Consumer ACLs
313
+ Consumers typically need:
314
+ - `Read` on topics
315
+ - `Read` on consumer groups
316
+ - `Describe` on topics (optional, for metadata)
317
+
318
+ ### Admin ACLs
319
+ Administrators typically need:
320
+ - `All` on `Cluster`
321
+ - Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
322
+
323
+ > **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
324
+
325
+ ## Import
326
+
327
+ Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
328
+
329
+ Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
311
330
 
312
331
  ```sh
313
- $ pulumi import kafka:index/acl:Acl test "User:Alice|*|Write|Deny|Topic|syslog|Prefixed"
332
+ $ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
314
333
  ```
315
334
 
316
335
  :param str resource_name: The name of the resource.
317
336
  :param pulumi.ResourceOptions opts: Options for the resource.
318
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
319
- will have access.
320
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
321
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
322
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
323
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
324
- `Any`, `Allow`, `Deny`.
325
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
326
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
327
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
328
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
329
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
330
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
337
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
331
338
  """
332
339
  ...
333
340
  @overload
@@ -336,34 +343,119 @@ class Acl(pulumi.CustomResource):
336
343
  args: AclArgs,
337
344
  opts: Optional[pulumi.ResourceOptions] = None):
338
345
  """
339
- A resource for managing Kafka ACLs.
346
+ The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
340
347
 
341
348
  ## Example Usage
342
349
 
350
+ ### Allow Producer Access to Topic
351
+
343
352
  ```python
344
353
  import pulumi
345
354
  import pulumi_kafka as kafka
346
355
 
347
- test = kafka.Acl("test",
348
- acl_resource_name="syslog",
356
+ producer = kafka.Acl("producer",
357
+ acl_resource_name="orders",
349
358
  acl_resource_type="Topic",
350
- acl_principal="User:Alice",
359
+ acl_principal="User:producer-service",
351
360
  acl_host="*",
352
361
  acl_operation="Write",
353
- acl_permission_type="Deny")
362
+ acl_permission_type="Allow")
363
+ # Also grant describe permission for producers
364
+ producer_describe = kafka.Acl("producer_describe",
365
+ acl_resource_name="orders",
366
+ acl_resource_type="Topic",
367
+ acl_principal="User:producer-service",
368
+ acl_host="*",
369
+ acl_operation="Describe",
370
+ acl_permission_type="Allow")
354
371
  ```
355
372
 
356
- ## Import
373
+ ### Allow Consumer Group Access
357
374
 
358
- ACLs can be imported using the following pattern
375
+ ```python
376
+ import pulumi
377
+ import pulumi_kafka as kafka
359
378
 
360
- ```sh
361
- $ pulumi import kafka:index/acl:Acl test "acl_principal|acl_host|acl_operation|acl_permission_type|resource_type|resource_name|resource_pattern_type_filter"
379
+ # Allow read access to topic
380
+ consumer_read = kafka.Acl("consumer_read",
381
+ acl_resource_name="orders",
382
+ acl_resource_type="Topic",
383
+ acl_principal="User:consumer-service",
384
+ acl_host="*",
385
+ acl_operation="Read",
386
+ acl_permission_type="Allow")
387
+ # Allow access to consumer group
388
+ consumer_group = kafka.Acl("consumer_group",
389
+ acl_resource_name="order-processors",
390
+ acl_resource_type="Group",
391
+ acl_principal="User:consumer-service",
392
+ acl_host="*",
393
+ acl_operation="Read",
394
+ acl_permission_type="Allow")
395
+ ```
396
+
397
+ ### Prefix-Based Access Control
398
+
399
+ ```python
400
+ import pulumi
401
+ import pulumi_kafka as kafka
402
+
403
+ # Grant access to all topics with prefix "logs-"
404
+ logs_access = kafka.Acl("logs_access",
405
+ acl_resource_name="logs-",
406
+ acl_resource_type="Topic",
407
+ resource_pattern_type_filter="Prefixed",
408
+ acl_principal="User:log-aggregator",
409
+ acl_host="*",
410
+ acl_operation="Read",
411
+ acl_permission_type="Allow")
362
412
  ```
363
- e.g.
413
+
414
+ ### Admin User with Full Access
415
+
416
+ ```python
417
+ import pulumi
418
+ import pulumi_kafka as kafka
419
+
420
+ # Grant cluster-level admin access
421
+ admin_cluster = kafka.Acl("admin_cluster",
422
+ acl_resource_name="kafka-cluster",
423
+ acl_resource_type="Cluster",
424
+ acl_principal="User:admin",
425
+ acl_host="*",
426
+ acl_operation="All",
427
+ acl_permission_type="Allow")
428
+ ```
429
+
430
+ ## Common ACL Patterns
431
+
432
+ ### Producer ACLs
433
+ Producers typically need:
434
+ - `Write` and `Describe` on topics
435
+ - `Write` on `TransactionalID` (for transactional producers)
436
+ - `IdempotentWrite` on `Cluster` (for idempotent producers)
437
+
438
+ ### Consumer ACLs
439
+ Consumers typically need:
440
+ - `Read` on topics
441
+ - `Read` on consumer groups
442
+ - `Describe` on topics (optional, for metadata)
443
+
444
+ ### Admin ACLs
445
+ Administrators typically need:
446
+ - `All` on `Cluster`
447
+ - Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
448
+
449
+ > **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
450
+
451
+ ## Import
452
+
453
+ Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
454
+
455
+ Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
364
456
 
365
457
  ```sh
366
- $ pulumi import kafka:index/acl:Acl test "User:Alice|*|Write|Deny|Topic|syslog|Prefixed"
458
+ $ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
367
459
  ```
368
460
 
369
461
  :param str resource_name: The name of the resource.
@@ -381,13 +473,13 @@ class Acl(pulumi.CustomResource):
381
473
  def _internal_init(__self__,
382
474
  resource_name: str,
383
475
  opts: Optional[pulumi.ResourceOptions] = None,
384
- acl_host: Optional[pulumi.Input[str]] = None,
385
- acl_operation: Optional[pulumi.Input[str]] = None,
386
- acl_permission_type: Optional[pulumi.Input[str]] = None,
387
- acl_principal: Optional[pulumi.Input[str]] = None,
388
- acl_resource_name: Optional[pulumi.Input[str]] = None,
389
- acl_resource_type: Optional[pulumi.Input[str]] = None,
390
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None,
476
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
477
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
478
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
479
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
480
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
481
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
482
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
391
483
  __props__=None):
392
484
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
393
485
  if not isinstance(opts, pulumi.ResourceOptions):
@@ -426,13 +518,13 @@ class Acl(pulumi.CustomResource):
426
518
  def get(resource_name: str,
427
519
  id: pulumi.Input[str],
428
520
  opts: Optional[pulumi.ResourceOptions] = None,
429
- acl_host: Optional[pulumi.Input[str]] = None,
430
- acl_operation: Optional[pulumi.Input[str]] = None,
431
- acl_permission_type: Optional[pulumi.Input[str]] = None,
432
- acl_principal: Optional[pulumi.Input[str]] = None,
433
- acl_resource_name: Optional[pulumi.Input[str]] = None,
434
- acl_resource_type: Optional[pulumi.Input[str]] = None,
435
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None) -> 'Acl':
521
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
522
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
523
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
524
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
525
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
526
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
527
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None) -> 'Acl':
436
528
  """
437
529
  Get an existing Acl resource's state with the given name, id, and optional extra
438
530
  properties used to qualify the lookup.
@@ -440,19 +532,7 @@ class Acl(pulumi.CustomResource):
440
532
  :param str resource_name: The unique name of the resulting resource.
441
533
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
442
534
  :param pulumi.ResourceOptions opts: Options for the resource.
443
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
444
- will have access.
445
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
446
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
447
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
448
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
449
- `Any`, `Allow`, `Deny`.
450
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
451
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
452
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
453
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
454
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
455
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
535
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
456
536
  """
457
537
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
458
538
 
@@ -467,65 +547,41 @@ class Acl(pulumi.CustomResource):
467
547
  __props__.__dict__["resource_pattern_type_filter"] = resource_pattern_type_filter
468
548
  return Acl(resource_name, opts=opts, __props__=__props__)
469
549
 
470
- @property
550
+ @_builtins.property
471
551
  @pulumi.getter(name="aclHost")
472
- def acl_host(self) -> pulumi.Output[str]:
473
- """
474
- Host from which principal listed in `acl_principal`
475
- will have access.
476
- """
552
+ def acl_host(self) -> pulumi.Output[_builtins.str]:
477
553
  return pulumi.get(self, "acl_host")
478
554
 
479
- @property
555
+ @_builtins.property
480
556
  @pulumi.getter(name="aclOperation")
481
- def acl_operation(self) -> pulumi.Output[str]:
482
- """
483
- Operation that is being allowed or denied. Valid
484
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
485
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
486
- """
557
+ def acl_operation(self) -> pulumi.Output[_builtins.str]:
487
558
  return pulumi.get(self, "acl_operation")
488
559
 
489
- @property
560
+ @_builtins.property
490
561
  @pulumi.getter(name="aclPermissionType")
491
- def acl_permission_type(self) -> pulumi.Output[str]:
492
- """
493
- Type of permission. Valid values are `Unknown`,
494
- `Any`, `Allow`, `Deny`.
495
- """
562
+ def acl_permission_type(self) -> pulumi.Output[_builtins.str]:
496
563
  return pulumi.get(self, "acl_permission_type")
497
564
 
498
- @property
565
+ @_builtins.property
499
566
  @pulumi.getter(name="aclPrincipal")
500
- def acl_principal(self) -> pulumi.Output[str]:
501
- """
502
- Principal that is being allowed or denied.
503
- """
567
+ def acl_principal(self) -> pulumi.Output[_builtins.str]:
504
568
  return pulumi.get(self, "acl_principal")
505
569
 
506
- @property
570
+ @_builtins.property
507
571
  @pulumi.getter(name="aclResourceName")
508
- def acl_resource_name(self) -> pulumi.Output[str]:
572
+ def acl_resource_name(self) -> pulumi.Output[_builtins.str]:
509
573
  """
510
- The name of the resource.
574
+ The name of the resource
511
575
  """
512
576
  return pulumi.get(self, "acl_resource_name")
513
577
 
514
- @property
578
+ @_builtins.property
515
579
  @pulumi.getter(name="aclResourceType")
516
- def acl_resource_type(self) -> pulumi.Output[str]:
517
- """
518
- The type of resource. Valid values are `Unknown`,
519
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
520
- """
580
+ def acl_resource_type(self) -> pulumi.Output[_builtins.str]:
521
581
  return pulumi.get(self, "acl_resource_type")
522
582
 
523
- @property
583
+ @_builtins.property
524
584
  @pulumi.getter(name="resourcePatternTypeFilter")
525
- def resource_pattern_type_filter(self) -> pulumi.Output[Optional[str]]:
526
- """
527
- The pattern filter. Valid values
528
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
529
- """
585
+ def resource_pattern_type_filter(self) -> pulumi.Output[Optional[_builtins.str]]:
530
586
  return pulumi.get(self, "resource_pattern_type_filter")
531
587